Solved

I have fortiGate 30D that have 5 ports (1WAN and 4 LAN ports). now i have two ISP, can i use LAN port to connect to ISP link as WAN port. because in fortigate 30D, it has WAN Link Load Balancing. Thank in advanced

We have users with extra email aliases attached to their Microsoft Exchange accounts. I had LDAP authentication profile selected with Recipient Verification enabled  and discovered due to a user complaint that all of the emails destined to one of these attached aliases were automatically rejected. I changed the authentication method to SMTP and now it seems that any email to our @domain.com is accepted and everything else is rejected. I am pretty sure that this is not the work of the recipient verification feature but actually the recipient policy I have in place. Will recipient verification work correctly with attached aliases? How do I get recipient verification working via SMTP/ESMTP?

Hello, is there a version of FortiExplorer that is offline installable?I need to install it on education-computers which are not online. RegardsSascha 

Hello everyone, I'm looking to take the NSE5 exam and was wondering if anyone who has already taken it could share their experience?  Many thanks!A

Dears, I want to disable tcp state by-pass for a particular source and destination as per below link of cisco, how we can do in fortigate. http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118995-configure-asa-00.html#anc7 Thanks

How often are the IPS signatures updated? For instance this advisory was just posted @ https://www.us-cert.gov/ncas/alerts/TA17-164A Thanks

Hi experts, I have very simple project that they need firewall solution and I am compatible with fortinet products. So, is there any trick that I crack fortigate-vm and use it forever without loosing my configurations?   regards

I am running 5.2 on a 60C, with FortiClient 5.2.1 on all clients, all of which are " on-net" . However, on the 60C, all of the clients show up as " off-net" . Is there something that I need to do in order to make them register properly?

Hello! Guys, need help... Cant understand the problem. Have a lot of branch offices with FortiWiFis 30E-3G4G-INTL there, and 300D in the center. All of them are connected with ipsec vpn to center (300D). So... Yesterday I was removing old Zywall with brand new FG. New comps with win8, 10, iphones and androids worked perfect. But windows 7 saw only local lan... All of devices got their ips through FG's DHCP with correct gateways and DNS... Yep... And there were no any logs  about sevens on the FG... I replaced FG with old zywall - and everything started to work. What is this? Thanks!

Hello, we having trouble with throughput the SSL VPN on Windows Latency from the client to the Fortigate is about 20ms and bandwidth in Fortigate site is 1Gbps and client site is 100Mbbps First, when connecting locally over the internal gigabit network (with near-zero latency), performance easily exceeds about 60Mbps for download on the client. I verified through trace routes, the route table, and Task Manager that tested traffic was indeed flowing through SSL VPN. This tells me that the underlying hardware is capable. However, when testing from off-site (at least 100Mbps and 20ms latency), the performance changes. From the client' s perspective, the download rate through SSL VPN is about 13Mbps and the upload is the problem in that it cannot exceed about 2-3Mbps.It seems that the increased latency is the contributing factor. Given that the SSL VPN uses TCP, my guess is that there' s an issue with TCP window scaling of the SSL VPN connection itself, especially when the client is

Is it possible to return a list of unused firewall addresses in the cli?This is directly related to the Ref column in the GUI. However the ref column can not be sorted or filtered.So the question might be if the ref count can be seen in the cli somehow? I am aware of diag sys checkused, but the opposite is required here.It would be possible to write a script to do this but obviously if the functionality exists already that would be better. Backstory, firmware is 4.3 and we've hit the address table limit. Our immediate need is to free some addresses prior to a firmware upgrade.

Hello folks, The setup is as follows:-The users use FortiClient 5.4 to connect to the FG (running 5.4.4) through SSL VPN.-The users is authenticated by AD (Windows 2008 R2) using LDAPS.-The users can successfully authenticated, and change their passwords (if the passwords are expired, or the user account has to change the password at next login). The problem is, if the user is configured to use two-factor authentication (FortiToken), the user can login but cann't change his password and get "Permission denied (-455)" error, as follows:-The user is asked to enter his username/password.-Then is asked to enter the new password.-Then get the above error message.-In the AD, nothing change. Could anyone help me in resolving this issue? BR,M Zaki

Hello, I currently have a setup with our Domain Controller's DNS Server which forwards all external queries to a FortiGate 60C. To allow network computers to lookup each other, I have assigned the DNS server for our internal network interface to point to the DNS Server which sits on our Domain Controller. Hence, all connected machines will use the Domain Controller's Internal DNS initially to find network resources and on the instance it can't for external resources, it forwards all requests to FortiGate to query the ISP DNS servers. For expansion purposes, I am looking at placing a Domain Controller at branch offices which are currently segmented by different subnet zones i.e. Main Office DNS Zone = 10.0.0.0Branch Office 1# DNS Zone 10.0.30.0Branch Office 2# DNS Zone = 10.0.70.0 Each office is linked together via IPSec Tunnels hence, resources are visible to one another despite being on different locations. Given that Domain Controllers require DNS to work, I

I have an 80D unit and I want to configure it to allow HTTPS/HTTP/SSH services hosted on 2 difference internal servers. I have been reading a lot of the forums but still can not quite get the 2nd pubic IP to do what I need. To hide my Public IPs a bit I'll use the "Public.56" && "Public.58" as the externally assigned IPv4 addressesPort 1: Public.56Port 4: Internal 192.168.242.1I can successfully port forward 22 (SSH) and 80(HTTP) from Port 1 to Port 4 and to the internal server at 192.168.242.120. This has been working just fine for a while now. No issues there. I now have a physical 2nd server that also serves up SSH and HTTPS. For reasons beyond my control when accessing the SSH the port MUST be 22 from the outside. Clients have made FW rules on their end for their developers to connect on our port 22. I have 4 more Public IPs available to us so I thought I would fire up another set of physical ports on the 80D: Port 2: Public.58Port 3: Internal 10.0.242.1 I ne

Fortinet released IPS signature ISC.BIND.TKEY.Query.Reponse.Handling.DoS to address this vulnerability. How can i create custom IPS signature?

Hi,does anyone have a full list of forticlient update servers? we have a "safe" network with no internet access, but i want to make a policy that will allow the forticlient to update, but in order to do so i need a list of forticlient update servers. currently i allow "update.fortiguard.net, service.fortiguard.net" but no updates. I can ping the servers from the safe network. anyone?

Hello! I have a Hardware Switch "internal" with two Physical Interfaces Members and I need one of the Physical Interface to create a new Phisical Vlan. It´s possible to remove one of thems , Could I have a Hardware Switch "internal" with only one physical interface? or... Could I delete the Hardware Switch "internal" ?? thanks

Hi, I'm new to the forums so I bid you all a good hello first and foremost. I'm currently seeing an issue due to the aggressive nature in which our 100D ha cluster is reusing source nat ports for address translation.  This is causing an issue with one of our web services, where by the source port is reused too quickly and causes the session data to be dropped. I believe the issue is caused by the server we are connecting to having TIME_WAIT configured for a 2 minute interval and our fortinet reusing the source port after a few seconds. Would creating a policy to increase the time to live session timer help in this instance ? I'm just concerned by increasing the amount of time sessions are able to sit within the firewall's memory this will potentially have a negative effect on the performance even if it does rectify our issue. We had a Cisco ASA HA setup previously which we never encountered this issue, it seems its related to the way fortios applies port addres

Greetings to youI would like to know how mach forticlient take to update their AV database!? now there as new ransomware called [size="3"]WannaCry hitting computers ! did forticlient update their AV signature ? to detect this attack ? [/size]

Hi Everyone, I'm a new network admin and new user of Fortinet, can you guide me on how can I get a monthly report (Top destination, Top source, etc) on my unit. Is there any other tool I need? Version: v5.4.4,build5968Also, can you suggest a monitoring tool for my network traffic.  Thank you.

If I need to make a change in the VPN phase II, this change must be execute at the same time at both ends of the vpn tunnel otherwise the tunnel go down? 

Hello, We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415. We've deployed the builting Fortinet certificate "Fortinet_CA_SSLProxy.cer" on all workstations.We've a policy with "SSL/SSH Inspection" and "Application Sensor" Profile to manage WebEx communications (allow audio/video and deny remote control or other features). But we obtain a certificate error when we use WebEx (see attachment): "you cannot connect to audio or video because we cannot validate the security certificate to your WebEx site". Do  you know how to avoid this pop-up? Regards, Chris

In my company we have an Fortigate 100d can someone please help me so that i can isolate this ports due to the ransomware attack that happened the last days.Thank you very much.

Hello, I recently upgraded my fortiOS to 5.6.0 in my 300D, so now I receive logs from the fortigate I get the logs with the actual date but when I want to display them I get "No entry found". Like I stated before I have fortimanager/analyzer 5.4.2 it's the latest version.Is there anything to do? Is it a compatibility issue? In that case, should I wait until a new release for the fortianalyzer? I tried everything else, removing and rebuilding the DB but didn't work.Thank you for your answers. Regards.

Hello, I have 2x Fortigate 200B with firmware  v4.0,build0632,120705 (MR3 Patch 8). not too much traffic and sessions: Ca 200 Mb/s , up to 10k ip packets/s , up to 15k active session. I have noticed that sometimes cpu is very high but only user part. It happens mostly, every 5-10 minutes for more less 10-20s but sometimes it takes much more time as You can see on day graph  I did some debug but i can't see nothing wrong.   I turn off: snmp access, widget in dashborad, tune tcp timers but without success.  Still high cpu user. What can be reason of that? How can i debug this more deeply ? Below some of my ouputsBig thanks for help  # get system performance statusCPU states: 1% user 25% system 0% nice 74% idleCPU0 states: 1% user 25% system 0% nice 74% idleMemory states: 64% usedAverage network usage: 72437 kbps in 1 minute, 114673 kbps in 10 minutes, 110949 kbps in 30 minutesAverage sessions: 7546 sessions in 1 minute, 7650 sessions in 10 min